Zscaler Security Advisories
Zscaler Protects against Multiple Security Vulnerabilities in Internet Explorer, Microsoft Office, NDIS, and .NET Framework
Zscaler, working with Microsoft through their MAPP program, has proactively deployed protections for the following 27 vulnerabilities included in the November 2015 Microsoft security bulletins. Zscaler will continue to monitor exploits associated with all vulnerabilities in the November release and deploy additional protections as necessary.
Cumulative Security Update for Internet Explorer
Severity: Critical
Affected Software
- nternet Explorer 7
- Internet Explorer 8
- Internet Explorer 9
- Internet Explorer 10
- Internet Explorer 11
CVE-2015-6064 – Microsoft Browser Memory Corruption Vulnerability
CVE-2015-6065 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6066 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6070 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6071 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6072 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6073 – Microsoft Browser Memory Corruption Vulnerability
CVE-2015-6075 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6077 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6078 – Microsoft Browser Memory Corruption Vulnerability
CVE-2015-6079 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6081 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6084 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6085 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6086 – Internet Explorer Information Disclosure Vulnerability
CVE-2015-6087 – Internet Explorer Memory Corruption Vulnerability
CVE-2015-6088 – Microsoft Browser ASLR Bypass
Description: This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Security Update for Microsoft Windows to Address Remote Code Execution
Severity: Critical
Affected Software
- Windows Vista Service Pack 2
- Windows Server 2008 Service Pack 2
- Windows 7 Service Pack 1
- Windows Server 2008 R2 Service Pack 1
- Windows 8 and Windows 8.1
- Windows Server 2012 and Windows Server 2012 R2
- Windows RT and Windows RT 8.1
- Windows 10
CVE-2015-6100 - Windows Kernel Memory Elevation of Privilege Vulnerability
CVE-2015-6101 - Windows Kernel Memory Elevation of Privilege Vulnerability
CVE-2015-6102 - Windows Kernel Memory Information Disclosure Vulnerability
CVE-2015-6109 - Windows Kernel Memory Information Disclosure Vulnerability
Description: This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker convinces a user to open a specially crafted document or to visit an untrusted webpage that contains embedded OpenType fonts.
Security Updates for Microsoft Office to Address Remote Code Execution
Severity: Important
Affected Software
- Microsoft Office 2007 Service Pack 3
- Microsoft Office 2010 Service Pack 2
- Microsoft Office 2013 Service Pack 1
- Microsoft Office 2013 RT
- Microsoft Office 2016
- Microsoft Office for Mac 2011
- Microsoft Office for Mac 2016
- Microsoft Office Compatibility Pack Service Pack 3
- Microsoft Excel/Word Viewer
CVE-2015-6038 - Microsoft Office Memory Corruption Vulnerability
CVE-2015-6091 - Microsoft Office Memory Corruption Vulnerability
CVE-2015-6092 - Microsoft Office Memory Corruption Vulnerability
Description: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Security Update for NDIS to Address Elevation of Privilege
Severity: Important
Affected Software
- Windows Vista Service Pack 2
- Windows Server 2008 Service Pack 2
- Windows 7 Service Pack 1
- Windows Server 2008 R2 Service Pack 1
CVE-2015-6098 – Windows NDIS Elevation of Privilege Vulnerability
Description: This security update resolves a vulnerability in Microsoft Windows NDIS. The vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application.
Security Updates in .NET Framework to Address Elevation of Privilege
Severity: Critical
Affected Software
- Windows Vista Service Pack 2
- Windows Server 2008 Service Pack 2
- Windows 7 Service Pack 1
- Windows Server 2008 R2 Service Pack 1
- Windows 8 and 8.1
- Windows Server 2012
- Windows Server 2012 R2
- Windows RT
- Windows RT 8.1
- Windows 10
CVE-2015-6096 – .NET Information Disclosure Vulnerability
Description: This security update resolves vulnerabilities in Microsoft .NET Framework. The most severe of these vulnerabilities could allow elevation of privilege if an attacker could inject a client-side script in a user's browser. The script could then spoof content, disclose information, or take any action that the user could take on an affected website. However, attempts to exploit this vulnerability would require user interaction.
Security Update in Winsock to Address Elevation of Privilege
Severity: Important
Affected Software
- Windows Vista Service Pack 2
- Windows Server 2008 Service Pack 2
- Windows 7 Service Pack 1
- Windows Server 2008 R2 Service Pack 1
- Windows 8 and 8.1
- Windows Server 2012
- Windows Server 2012 R2
- Windows RT
- Windows RT 8.1
- Windows 10
CVE-2015-2478 – Winsock Elevation of Privilege Vulnerability
Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to a target system and runs specially crafted code that is designed to exploit the vulnerability.